Skip to contentDarylldoyle Svg-sanitizer vulnerabilities
- darylldoyle svg-sanitizersvg-sanitizer before 1.1.0 XSS via animateTransform on SafariCVE-2026-1214475.3 Medium
- darylldoyle svg-sanitizersvg-sanitizer 0.5.0 before 1.1.0 Incomplete url() Filtering in SVG AttributesCVE-2026-1214465.3 Medium
- darylldoyle svg-sanitizersvg-sanitizer 1.0.0 before 1.1.0 ReDoS and Fail-Open via image-set CSS StrippingCVE-2026-1214458.2 High
- darylldoyle svg-sanitizersvg-sanitizer 0.11.0 before 1.1.0 Algorithmic Complexity DoS via use Reference GraphCVE-2026-1214448.7 High
- darylldoyle svg-sanitizersvg-sanitizer from 1.1.0 before 1.1.1 Denial of Service via Unclosed TagCVE-2026-1214436.9 Medium
- darylldoyle svg-sanitizersvg-sanitizer 0.11.0 before 1.1.0 Uncaught LogicException DoS via sanitize()CVE-2026-1175416.9 Medium
- darylldoyle svg-sanitizersvg-sanitizer before 1.1.0 Quadratic CPU-Exhaustion DoS via PHP-Tag Stripping LoopCVE-2026-1175408.7 High
- darylldoyle svg-sanitizerdarylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference BypassCVE-2026-1175395.1 Medium
- darylldoyle svg-sanitizersvg-sanitizer: Mixed-case xlink:HrEf skips the `<use>` nesting-DoS check in Resolver::processReferencesCVE-2026-107381Fix available6.5 Medium
- darylldoyle svg-sanitizerenshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference CollisionCVE-2026-107380Fix available5.4 Medium
- darylldoyle svg-sanitizerenshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration CrashCVE-2026-107379Fix available6.5 Medium
- darylldoyle svg-sanitizersvg-sanitizer By-Passing Attribute SanitizationCVE-2025-55166Fix available5.1 Medium
- darylldoyle svg-sanitizerCross-site Scripting in svg-sanitizerCVE-2022-23638Fix available6.2 Medium